[drk-ram]

What this changes

Contributor: Raghuvar Durga (@drk-ram)

Closes #571 (and closes the remaining open findings 6, 12, and 20 from #448):

1. spec/registry-anchor-v1.md §4 (#448 Item 20):
   • Replaces An anchor is recorded as one JSON object with exactly these fields: in §4 (## 4. Registry entry) with An anchor is recorded as one JSON object carrying these required fields:.
   • Documents that an entry may also carry optional log-profile fields such as canonicalization_id (identifying the leaf canonicalization profile) and mmr_checkpoint (or other transparency-log checkpoint metadata), and that a verifier that does not consume optional entry fields ignores them rather than rejecting the entry.
2. conformance/tests/vectors/valid_cmcp_runtime.json (#448 Item 6):
   • Replaces the placeholder "signature": "unsigned-test-vector" in conformance/tests/vectors/valid_cmcp_runtime.json with a valid 64-byte canonical unpadded base64url Ed25519 signature (3IxZkIUnz9FUnYHmO-7cBO6Cyg80FGycchnUYMyQPGtFTH1gwGD0fBl8RQpBQhQh1zwCOuqO38Q4SHawnpdLDg) computed over the RFC 8785 (JCS) canonical bytes of the claim under its embedded RFC 8032 §7.1 Test Vector 1 public key (x = 11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo).
   • Updates conformance/tests/unit/test_runner.py to add test_cmcp_runtime_vector_signature_verifies, proving TR-SIG passes on the unmutated valid_cmcp_runtime.json at Level 1.
   • Leaves the frozen historical differential snapshot trust-record-verify/differential/corpus/vectors-trace-tests-3af2b53/valid_cmcp_runtime.json untouched so its import-manifest.json SHA-1 pin remains intact.
3. examples/citation-resolution/README.md (#448 Item 12):
   • Documents why expected.citations[*].evidence.exception carries "KeyError" in the resolver_raised vectors: the consumer records the class or type name of whatever exception the caller-supplied resolver raised (type(exc).__name__ in Python), and the reference test harness's lookup-table resolver (table[uri]) raises Python's KeyError when a URI is absent from context.resolutions. Notes how conformance runners in Go, Rust, or TypeScript handle this harness artifact.

Type of change

• Editorial (typo, link fix, clarification: no normative effect)
• Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

Companion specification spec/registry-anchor-v1.md §4 (Registry entry), conformance/tests/vectors/valid_cmcp_runtime.json, and examples/citation-resolution/README.md (no changes to spec/trace-v0.2.md).

Tests for a fix

• tests/test_go_verifier_findings_6_12_20.py::test_valid_cmcp_runtime_vector_has_valid_ed25519_signature fails on origin/main because conformance/tests/vectors/valid_cmcp_runtime.json carries "signature": "unsigned-test-vector", and passes on HEAD with TR-SIG-001 reporting Status.PASS.
• tests/test_go_verifier_findings_6_12_20.py::test_registry_anchor_v1_section_4_allows_optional_entry_fields fails on origin/main because spec/registry-anchor-v1.md §4 requires "with exactly these fields" and omits canonicalization_id and mmr_checkpoint.
• tests/test_go_verifier_findings_6_12_20.py::test_citation_resolution_readme_documents_harness_keyerror_exception fails on origin/main because examples/citation-resolution/README.md does not document why expected.citations[*].evidence.exception is "KeyError" for non-Python conformance runners.

Validation commands and results:

• pytest tests/test_go_verifier_findings_6_12_20.py tests/test_citation_resolution.py -> passed (49 passed)
• pytest conformance/tests -> passed (782 passed, 5 xpassed)
• python tools/review_bar.py --base origin/main --head HEAD -> passed (3 fail on behaviour, 0 fail on a missing name or file, 0 pass or skip)
• python tools/check_dashes.py -> passed (no dashes outside examples/, spec/trace-v0.1.md)
• ruff check tests/test_go_verifier_findings_6_12_20.py conformance/tests/unit/test_runner.py -> passed
• mypy --strict tests/test_go_verifier_findings_6_12_20.py -> passed

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change)
• Breaking changes marked with <!-- CHANGED: #NNN: description --> in spec text
• Backward compatibility statement included (for breaking changes)

[dinakarjs]

Reviewed exact head 246478c. The replacement fixture has a canonical 64-byte unpadded Ed25519 signature over the complete unmodified JCS signing body. The required registry entry fields remain required while optional profile fields are explicitly permitted. The citation README correctly distinguishes a lookup-stub exception class from a protocol constant. The frozen differential copy is outside the five-file diff and remains unchanged.

Independent Linux/Python 3.12.14 with matching hash-locked dependencies and explicit checkout paths: 46 selected root/citation tests and 782 conformance tests pass, with 5 existing XPASS outcomes. The first conformance attempt lacked installed distribution metadata (two CLI metadata failures); installing the local package metadata without changing sources resolved that environment issue, and the complete rerun passes. DCO and whitespace checks pass; returned technical workflows succeed, Dependabot skipped. Bounded fixture/editorial compatibility review, not fresh cMCP execution or a new normative protocol acceptance. Reviewed with OpenAI Codex assistance.

[imran-siddique]

Thanks @drk-ram, and @dinakarjs for the review. Approving as sponsor for the section 4 wording: the reference registry already writes canonicalization_id and mmr_checkpoint into its entries, so "exactly these fields" was wrong about what we ship. This closes items 6, 12 and 20 of #448.